Windows在内核中通过clfs.sys驱动来实现Common Log File System(CLFS)。由于日志文件由驱动解析以及其本身结构的复杂性，clfs.sys在这些年来出现了很多安全问题，也成为Windows Kernel中一个常见的攻击面。CVE-2022-35803是微软在2022年9月修复的CLFS本地提权漏洞，这个漏洞可以认为是CVE-2022-24481的补丁绕过。本文将从分析CVE-2022-24481开始，并介绍其不完善的补丁修复是如何导致CVE-2022-35803的出现。

CVE-2022-24481

__int64 __fastcall CClfsLogFcbPhysical::FlushMetadata(__int64 CClfsLogFcbPhy){ClfsClientContext = 0i64;  v2 = CClfsBaseFile::AcquireClientContext(*(ClfsLogFcbPhyObj + 0x2A8), 0, &ClfsClientContext);  if ( v2 >= 0 && (ClfsClientContext_1 = ClfsClientContext) != 0i64 )  {    eState = ClfsClientContext->eState;    v5 = *(ClfsLogFcbPhyObj + 0x15C);    ClfsClientContext->llCreateTime = *(ClfsLogFcbPhyObj + 0x1A0);    ClfsClientContext_1->llAccessTime = *(ClfsLogFcbPhyObj + 0x1A8);    ClfsClientContext_1->llWriteTime = *(ClfsLogFcbPhyObj + 0x1B0);    ClfsClientContext_1->lsnOwnerPage.ullOffset = *(ClfsLogFcbPhyObj + 0x538);    ClfsClientContext_1->lsnArchiveTail.ullOffset = *(ClfsLogFcbPhyObj + 0x1E0);    ClfsClientContext_1->lsnBase.ullOffset = *(ClfsLogFcbPhyObj + 0x1D8);    ClfsClientContext_1->lsnLast.ullOffset = *(ClfsLogFcbPhyObj + 0x1E8);    ClfsClientContext_1->lsnRestart.ullOffset = *(ClfsLogFcbPhyObj + 0x1F0);    ClfsClientContext_1->cbFlushThreshold = *(ClfsLogFcbPhyObj + 0x16C);    HIWORD(ClfsClientContext_1->cidClient) = *(ClfsLogFcbPhyObj + 0x168);    v6 = eState | 8;    if ( (v5 & 0x10) == 0 )      v6 = eState;    ClfsClientContext_1->eState = v6;...}...}

__int64 __fastcall CClfsLogFcbPhysical::Initialize(){...CClfsBaseFile::AcquireClientContext(*(ClfsLogFcbPhyObj + 0x2A8), 0, &ClfsClientContext);...if ( (ClfsClientContext->eState & 0x20) == 0 || (*(*ClfsLogFcbPhyObj + 0x138i64))(ClfsLogFcbPhyObj) )  {    ClfsClientContext_1 = ClfsClientContext;    *(ClfsLogFcbPhyObj + 0x1A0) = ClfsClientContext->llCreateTime;    *(ClfsLogFcbPhyObj + 0x1A8) = ClfsClientContext_1->llAccessTime;    *(ClfsLogFcbPhyObj + 0x1B0) = ClfsClientContext_1->llWriteTime;    *(ClfsLogFcbPhyObj + 0x1C8) = 0i64;    *(ClfsLogFcbPhyObj + 0x538) = ClfsClientContext_1->lsnOwnerPage.ullOffset;    *(ClfsLogFcbPhyObj + 0x1E0) = ClfsClientContext_1->lsnArchiveTail.ullOffset;    *(ClfsLogFcbPhyObj + 0x1D8) = ClfsClientContext_1->lsnBase.ullOffset;    *(ClfsLogFcbPhyObj + 0x1E8) = ClfsClientContext_1->lsnLast.ullOffset;    *(ClfsLogFcbPhyObj + 0x1F0) = ClfsClientContext_1->lsnRestart.ullOffset;    *(ClfsLogFcbPhyObj + 0x16C) = ClfsClientContext_1->cbFlushThreshold;...}...}

若将客户端上下文的llCreateTime字段设置为用户空间地址，并将llCreateTime字段与容器上下文的pContainer字段重叠。调用函数CClfsLogFcbPhysical::FlushMetadata后，容器上下文的pContainer字段（该字段存储指向CClfsContainer对象的内核指针）将被修改为用户空间地址。

FlushMetadata函数可能会在处理日志的多个时期触发，其中包括在关闭日志文件时，在执行完FlushMetadata后，clfs.sys会调用函数CClfsLogFcbPhysical::CloseContainers来关闭容器：

__int64 __fastcall CClfsLogFcbPhysical::CloseContainers(__int64 ClfsLogFcbPhyObj){  ClfsContainerContext = 0i64;  v1 = 0;  v2 = *(ClfsLogFcbPhyObj + 0x554);  if ( v2 >= *(ClfsLogFcbPhyObj + 0x550) )    return v1;  while ( 1 )  {    v1 = CClfsBaseFile::AcquireContainerContext(           *(ClfsLogFcbPhyObj + 0x2A8),           *(ClfsLogFcbPhyObj + 4i64 * (v2 & 0x3FF) + 1368),           &ClfsContainerContext);    if ( v1 < 0 )      break;    v4 = ClfsContainerContext;    if ( !ClfsContainerContext )      break;    pContainer = ClfsContainerContext->pContainer;  <<-------- 2    if ( pContainer )    {      CClfsContainer::Close(pContainer);        <<-------- 3      (*(*v4->pContainer + 8i64))(v4->pContainer);      v4->pContainer = 0i64;    }    CClfsBaseFile::ReleaseContainerContext(*(ClfsLogFcbPhyObj + 0x2A8), &ClfsContainerContext);    if ( ++v2 >= *(ClfsLogFcbPhyObj + 0x550) )      return v1;  }  return 0xC01A000Di64;}

补丁分析

__int64 __fastcall CClfsBaseFile::ValidateRgOffsets(CClfsBaseFile *this, unsigned int *rgObject){  v2 = 0;  v3 = 0;  v6 = 0;  extraNum = 0;  logBlockPtr = *(*(this + 6) + 0x30i64);       // * _CLFS_LOG_BLOCK_HEADER  if ( !logBlockPtr )    return 0xC01A000Di64;  signOffset = logBlockPtr + *(logBlockPtr + 0x68);  if ( signOffset < logBlockPtr )    return 0xC01A000Di64;  qsort(rgOffsetArray, 0x47Cui64, 4ui64, CompareOffsets);  while ( 1 )  {    currentOffset = *rgOffsetArray;    if ( *rgOffsetArray - 1 <= 0xFFFFFFFD )    {      currentContext = CClfsBaseFile::OffsetToAddr(this);      if ( !currentContext )        break;      if ( currentOffset < 0x30 )        break;      v12 = currentOffset - 0x30;      v13 = extraNum * 4 + v3 + 0x30;      if ( v13 < v3 || v3 && v13 > v12 )   <<-------- 4        break;      v3 = v12;      if ( *currentContext == 0xC1FDF008 )      // CLFS_NODE_TYPE_CONTAINER_CONTEXT      {        extraNum = 12;      }      else      {        if ( *currentContext != 0xC1FDF007 )    // CLFS_NODE_TYPE_CLIENT_CONTEXT          return 0xC01A000D;        extraNum = 34;      }      v1 = &currentContext[extraNum];      if ( v1 < currentContext || v1 > signOffset )        break;    }    ++v6;    ++rgOffsetArray;    if ( v6 >= 0x47C )      return v2;  }  return 0xC01A000D;}

CVE-2022-35803

通过补丁分析可以看出，直接修改客户端上下文偏移的问题已经修复，但是否有另一种方法可以重叠字段并导致漏洞？

研究发现，从ValidateRgOffsets验证偏移到FlushMetadata修改数据，再到最后CloseContainers关闭容器期间都未对客户端上下文的类型值cidNode.cType字段（其用于表示上下文的类型）进行合法校验，这里存在可能被类型混淆的缺陷，如果将客户端上下文cidNode.cType修改为0xC1FDF008，那么在ValidateRgOffsets计算上下文间隔时，会错误地将客户端上下文与下一个上下文间隔限制为0x60，这将导致客户端上下文0x60~0x88偏移的区域与下一个上下文0~0x28偏移的区域重叠，新的漏洞出现，这便是CVE-2022-35803。

将客户端上下文的eState字段与容器上下文的pContainer字段重叠，然后触发FlushMetadata函数，便可将该字段进行或运算并重新存储：

__int64 __fastcall CClfsLogFcbPhysical::FlushMetadata(__int64 CClfsLogFcbPhy){  ClfsClientContext = 0i64;  v2 = CClfsBaseFile::AcquireClientContext(*(ClfsLogFcbPhyObj + 0x2A8), 0, &ClfsClientContext);  if ( v2 >= 0 && (ClfsClientContext_1 = ClfsClientContext) != 0i64 )  {    eState = ClfsClientContext->eState;    v5 = *(ClfsLogFcbPhyObj + 0x15C);    ...    v6 = eState | 8;    if ( (v5 & 0x10) == 0 )      v6 = eState;    ClfsClientContext_1->eState = v6;     ...  }  ...}

[in, optional] pcbContainer

The optional parameter that specifies the size of the container, in bytes.

The minimum size is 512 KB for normal logs and 1024 KB for multiplexed logs. The maximum size is approximately 4 gigabytes.

当数据被认为是地址时可以位于用户空间，完全可以利用此漏洞在用户空间伪造出容器对象的虚函数表，如下图所示：

混淆数据之前：

CVE-2022-35803补丁分析

__int64 __fastcall CClfsBaseFile::GetSymbol(        CClfsBaseFile *this,        unsigned int a2,        char ClientContextId,        struct _CLFS_CLIENT_CONTEXT **a4){...v12 = ClfsQuadAlign(0x88u);  if ( *(_DWORD *)(ClientContextAddr - 16) != (unsigned __int64)(ClientContextOffset_1 + v12)    || *(_DWORD *)ClientContextAddr != 0xC1FDF007    || *(_DWORD *)(ClientContextAddr + 4) != v12    || *(_BYTE *)(ClientContextAddr + 8) != ClientContextId )  {LABEL_12:    v8 = 0xC01A000D;    goto LABEL_13;  }...}

参考

[1]https://mp.weixin.qq.com/s/Uk0NocnYXMouwxz6OsuKUA